Vulnerability · Published Apr 5, 2021 · Assigned by WPScan

CVE-2021-24163Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure

High 8.8

In plain English

A high-severity information exposure in Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)1.4%top 26.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress	3.4.34 – before 3.4.34

Weakness: CWE-200

References

https://wpscan.com/vulnerability/55fde9fa-f6cd-4546-bee8-4acc628251c2 x_refsource_CONFIRM
https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/ x_refsource_MISC